The difference appears to be that the sudoers file supports the finite set of access checks the authors of sudo anticipated. If you need something more elaborate than that, write arbitrary javascript to the polkit api.